Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    6ab3677b51329a0d044c8e75d80e0f6d

  • Size

    3.1MB

  • MD5

    6ab3677b51329a0d044c8e75d80e0f6d

  • SHA1

    70b9ff61f42e0a27eace42a7f8fa00d7ea8fb991

  • SHA256

    7eb214c1bf3b304e98eb37ac52c1fdb22f2c9b5bdad78cd33bfba0c544218f74

  • SHA512

    192f61319db69801dd7fcebcea349fcc1d51cb00a30179e2df5eec4c5f748564857207627f3e523cc03034b31a3c345152d6970e0212e9d1d9d27c9a7daa2c9f

  • SSDEEP

    49152:EgTbJWbtaM4oNRU2Dhm/EGbKXTTUzChuLBXZ4+9/bkkd6wLP7qUxrGSr/Yfmgr3:JnStD4oTU2tRGmX3UxtaqTR7XNxDcfr3

  Score

  10^/10

  fabookienullmixerredlinesectopratsmokeloadervidar706anioldpub5aspackv2backdoordropperevasioninfostealerratspywarestealertrojanupxprivateloaderriseproloader

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Nirsoft

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    setup_installer.exe

  • Size

    3.0MB

  • MD5

    98cf7587435d603dbd7cf32b5dc985af

  • SHA1

    0920aa37113ca0ee6011873aeb0688914c0eb4ae

  • SHA256

    0eab15afca40da3808f9d4d14e804080cef0c17a3444ddaffaf5699b96fa5a17

  • SHA512

    1b22f8701440af46124e3c7eedb88f2ab9f825a931a8b7216f6a9629d955289ae0b5d61018e079ee0cda897a27a6f8ec97307ed7dba196823cc78aea4a7cce84

  • SSDEEP

    98304:x4pIByDNY6hGjNSP/sbrj14CvLUBsKnhl:x4p6yvh8Ogj1lLUCKnX

  Score

  10^/10

  fabookienullmixerprivateloaderredlineriseprosectopratsmokeloadervidar706anioldpub5aspackv2backdoordropperinfostealerloaderratspywarestealertrojanupxevasion

  • Detect Fabookie payload

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat

  • SectopRAT payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar

  • Nirsoft

  • Vidar Stealer

    stealer

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral3behavioral4